From 932fcf1871c6a45451a2b93e6427a32579e21ec7 Mon Sep 17 00:00:00 2001
From: Rony <rony_123@protonmail.ch>
Date: Wed, 20 Jul 2022 15:07:35 +0530
Subject: [PATCH] added Red Nue

---
 clusters/threat-actor.json | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index c984884f..e986b7cc 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -9963,6 +9963,24 @@
       },
       "uuid": "68d8c25b-8595-4c20-a5c7-a11a2a34b717",
       "value": "Vicious Panda"
+    },
+    {
+      "description": "Red Nue, active since at least 2017, is known for its use of the multi-platform LootRAt backdoor, also known as ReverseWindow. LootRAT has variants for Windows and Macintosh (reported in open source as Demsty), as well as an Android variant known as SpyDealer. Red Nue has also used another Windows backdoor known as WinDealer since at least 2019, when it deployed it to targets as part of a watering hole campaign on a Chinese news website for the Chinese diaspora community. Parts of Asia feature heavily in Red Nue's victimology.",
+      "meta": {
+        "country": "CN",
+        "refs": [
+          "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf",
+          "https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_301_shui-leon_en.pdf",
+          "https://blogs.jpcert.or.jp/en/2021/10/windealer.html",
+          "https://securelist.com/windealer-dealing-on-the-side/105946",
+          "https://blogs.blackberry.com/en/2022/06/threat-thursday-china-based-apt-plays-auto-updater-card-to-deliver-windealer-malware"
+        ],
+        "synonyms": [
+          "LuoYu"
+        ]
+      },
+      "uuid": "c73c8a76-1e44-44d6-b955-79f3a73582a1",
+      "value": "Red Nue"
     }
   ],
   "version": 233